Tycoon2FA phishing kit targets Microsoft 365 with new tricks

Summary: The Tycoon2FA phishing-as-a-service platform has been updated to enhance its stealth and evasion tactics, making it more difficult to detect phishing attempts targeting Microsoft 365 and Gmail accounts. Recent improvements include the use of invisible Unicode characters, a self-hosted CAPTCHA, and anti-debugging measures. Furthermore, there has been a significant increase in phishing attacks utilizing malicious SVG files, complicating detection efforts and necessitating enhanced security measures.Affected: Microsoft 365 and Gmail accounts

Keypoints :

• Tycoon2FA’s updates improve its ability to bypass multi-factor authentication and detection mechanisms.
• Techniques such as invisible Unicode characters and anti-debugging JavaScript reduce the effectiveness of security analysis.
• PhaaS platforms like Tycoon2FA are driving a surge in phishing attacks using SVG files, with a reported 1,800% increase in such tactics.